CVE-2024-0012

What it actually does

The vulnerability is an authentication bypass in the PAN-OS management web interface affecting PAN-OS 10.2, 11.0, 11.1, and 11.2. A network-reachable, unauthenticated attacker can bypass normal login requirements and obtain PAN-OS administrator privileges. Once authenticated as an administrator, the attacker can perform administrative actions through the web interface or API, including modifying configuration, creating access, changing policies, exporting sensitive settings, and chaining to other authenticated flaws such as CVE-2024-9474 for deeper privilege escalation or command execution. The issue does not affect Cloud NGFW or Prisma Access according to the advisory.

Why it matters to the business

Compromise of a PAN-OS management interface can give an attacker control over a firewall or related security appliance, allowing them to change security policy, create administrator access, disrupt connectivity, hide activity, or pivot deeper into the network. Because this vulnerability is in CISA KEV, has observed active exploitation, has very high EPSS, and is associated with ransomware activity, internet-exposed or broadly reachable management interfaces should be treated as urgent incident-response priorities rather than routine patching items.

How an attack unfolds

An attacker first identifies a PAN-OS management web interface that is reachable over the network, commonly by scanning internet-facing or overly permissive internal management ranges. The attacker then sends crafted HTTP requests that bypass normal authentication checks and obtains PAN-OS administrator-level access without valid credentials. With administrative privileges, the attacker can inspect and modify firewall configuration, create or alter administrator accounts, generate API access, change policies, disable protections, export sensitive configuration, or interfere with logging. In observed attack chains, the authentication bypass can be paired with authenticated privilege-escalation or command-execution vulnerabilities such as CVE-2024-9474, allowing the attacker to move from administrative web access to operating-system-level control. From there, the attacker can establish persistence, stage tools, pivot to protected networks, or support ransomware intrusion activity.

How to fix it

Upgrade affected PAN-OS releases to vendor-fixed versions immediately: PAN-OS 10.2.12-h2 or later, PAN-OS 11.0.6-h1 or later, PAN-OS 11.1.5-h1 or later, or PAN-OS 11.2.4-h1 or later, as applicable. If running an end-of-life branch, migrate to a supported fixed release. Cloud NGFW and Prisma Access are not affected per the vendor advisory. Independently of patching, restrict the management web interface to trusted administrative networks only, preferably through a dedicated management network, VPN, jump host, or allowlisted internal IP ranges; do not expose the management interface directly to the internet. Disable unnecessary management services, enforce MFA where supported for administrative access, review administrator accounts and API keys, rotate credentials and API keys if exposure is suspected, and verify logging is enabled and forwarded to a central system. If indicators of exploitation are present, treat the appliance as potentially compromised: preserve logs, collect forensic artifacts, review and restore configuration from a known-good baseline, rotate secrets stored on or accessible through the device, and consider rebuild/reimage procedures according to vendor and incident-response guidance.

How to confirm the fix worked

Confirm the installed PAN-OS version is at or above the vendor-fixed release for the deployed branch and that the upgrade completed successfully on all HA peers and managed devices. Verify from external and untrusted networks that the management web interface is not reachable. Validate that management access is restricted to approved administrative source ranges and that security policy or management-profile settings enforce those restrictions. Review the configuration for unexpected admin accounts, API keys, management access changes, and recent commits. Run a credentialed vulnerability scan or vendor-supported assessment to confirm the system no longer reports exposure. Avoid live exploitation tests in production; if validation requires HTTP probing, use safe checks that confirm access control and version state rather than attempting to bypass authentication.

Typical attack path

1. Locate a reachable PAN-OS management web interface on an affected version.
2. Confirm the interface is accessible from the attacker’s network location.
3. Send crafted HTTP requests that bypass management-interface authentication.
4. Obtain an administrator-level PAN-OS session or equivalent administrative capability.
5. Enumerate device configuration, administrator accounts, policies, VPN settings, and available management functions.
6. Create persistence through new admin access, API keys, configuration changes, or chained exploitation.
7. Optionally exploit an authenticated privilege-escalation or command-execution flaw such as CVE-2024-9474.
8. Modify security controls, export sensitive configuration, pivot into adjacent networks, or support ransomware operations.
9. Attempt to remove or reduce logs and blend subsequent activity into normal administrative operations.

How to detect it

Review management-plane access logs, web server logs, system logs, configuration logs, administrator authentication logs, Panorama logs, VPN/admin access records, and network telemetry for traffic to the PAN-OS management interface. Prioritize evidence of unauthenticated HTTP requests to management endpoints, especially requests using the header "X-PAN-AUTHCHECK: off" or requests to remote app/session creation paths. Look for new or modified administrator accounts, unexpected API key generation, configuration changes, altered security policies, disabled logging, changed management ACLs, new scheduled jobs, unexpected software/plugin installation, or configuration exports. If exploitation may have chained into command execution, inspect process execution artifacts and filesystem changes for shell commands, curl/wget downloads, reverse-shell tooling, temporary scripts, or unknown files under web-accessible and temporary directories. Correlate suspicious management requests with subsequent admin sessions, configuration commits, outbound connections from the appliance, and authentication attempts into adjacent infrastructure. Because active exploitation and ransomware usage are reported, absence of failed logins is not sufficient; this is an authentication bypass, so successful exploitation may appear as web requests followed by valid-looking administrative actions.

• X-PAN-AUTHCHECK: off
• /php/utils/createRemoteAppwebSession.php
• createRemoteAppwebSession.php
• /var/log/nginx/access.log
• /var/log/pan/traffic
• /var/log/pan/system
• /var/log/pan/config
• /tmp/
• /var/tmp/
• /dev/shm/
• wget http
• curl http
• bash -c
• sh -c
• python -c
• nc -e
• ncat -e
• /bin/bash
• /bin/sh

What your security team should do

• Immediately identify all PAN-OS 10.2, 11.0, 11.1, and 11.2 systems and determine whether their management web interfaces are reachable from the internet or broad internal networks.
• Patch exposed or reachable systems to the fixed PAN-OS releases first; this vulnerability is actively exploited, listed in CISA KEV, associated with ransomware activity, and had a CISA remediation deadline of 2024-12-09.
• Before or during patching, enforce strict management-plane access controls so only trusted administrative sources can reach the web interface.
• Hunt for prior exploitation using management web logs, configuration logs, administrator activity logs, and network telemetry, especially requests containing "X-PAN-AUTHCHECK: off" and access to "createRemoteAppwebSession.php".
• Review all administrator accounts, API keys, authentication profiles, management ACLs, security policies, commits, and exported configurations for unauthorized changes.
• If suspicious activity is found, initiate incident response, rotate administrator credentials and API keys, validate the full firewall configuration against a known-good baseline, and investigate downstream systems for lateral movement.
• Add SIEM detections for suspicious management-interface requests, unexpected admin creation, unusual commits, config exports, and outbound tool download behavior from appliances.
• Continuously monitor for any recurrence of management-interface exposure using external attack-surface scans and internal vulnerability scanning.